NIST Cybersecurity Framework 2.0 Explained for Finance Teams
A plain-English guide to NIST CSF 2.0 for finance and audit teams: the six functions including the new Govern function, profiles and tiers, and how it maps at a high level to DORA, NIS2, ISO 27001 and PCI DSS.
The NIST Cybersecurity Framework (CSF) 2.0, published by the US National Institute of Standards and Technology on 26 February 2024, is a free, voluntary framework that organises cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond and Recover. For finance teams, it offers a plain way to describe cyber risk in business terms, test controls and link security work to the EU's Digital Operational Resilience Act (DORA), the second Network and Information Security Directive (NIS2) and the ISO/IEC 27001 information security standard.
What the NIST CSF is, and what changed in 2.0
NIST first released the framework in 2014. Before version 2.0 it was titled the "Framework for Improving Critical Infrastructure Cybersecurity", and that name has now been dropped (NIST, 2024). Version 2.0 is written for any organisation, whatever its size, sector or maturity, from small charities to large corporations.
The CSF does not tell you exactly which controls to install. It sets out outcomes, then points to other standards and guidance for the detail. NIST maintains a searchable catalogue that maps CSF guidance to more than 50 other cybersecurity documents (NIST, 2024).
The biggest change in 2.0 is the new Govern function, which treats cybersecurity as an enterprise risk that senior leaders weigh alongside financial and reputational risk. For anyone working in finance or audit, that is the part of the framework that will feel most familiar. If you sit in a regulated EU financial entity, read this alongside our guide to DORA for finance teams.
The six functions explained
The CSF Core contains six functions, 22 categories and 106 subcategories, set out in NIST Cybersecurity White Paper (CSWP) 29 (NIST CSWP 29, 2024).
| Function | What it asks | A finance example |
|---|---|---|
| Govern | Is cyber risk strategy, policy and oversight set and communicated? | Board-approved risk appetite that covers cyber, with named owners |
| Identify | Do we understand our assets, suppliers and risks? | A register of finance systems, banking portals and key suppliers |
| Protect | Are safeguards in place? | Multi-factor login to the banking platform, staff awareness training |
| Detect | Can we spot attacks and anomalies? | Alerts on supplier bank-detail changes and unusual payments |
| Respond | Can we act on an incident? | A playbook for a suspected payment fraud, with reporting steps |
| Recover | Can we restore operations? | Tested plans to run payroll and payments if a key system is down |
Govern: why finance should care
Govern has six categories: organisational context; risk management strategy; roles, responsibilities and authorities; policy; oversight; and cybersecurity supply chain risk management (NIST CSWP 29, 2024). Many of these sit naturally with the finance function:
- Risk appetite and tolerance statements already exist for financial risk. Govern asks for the same discipline on cyber.
- Supply chain risk links to procurement, contract management and supplier due diligence.
- Oversight means reporting results to the board or audit committee and adjusting strategy. Our guide to board cyber governance and audit committee oversight covers this in more depth.
NIST links the CSF to enterprise risk management through its Interagency Report (IR) 8286 series and an Enterprise Risk Management Quick-Start Guide, both useful reading for finance and risk managers.
How finance and audit teams use it
Profiles: where are we, and where do we want to be?
An Organisational Profile describes your current and target position against the CSF outcomes. The gap between the two becomes an action plan with owners and budgets. NIST also publishes Community Profiles, baselines for a sector or shared need, including one for financial services (NIST, 2025).
Tiers: how mature is our approach?
The CSF uses four tiers to describe how rigorous an organisation's cyber risk management is: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4) (NIST CSWP 29, 2024). Tiers are not a pass or fail score. They help leaders agree what level is appropriate.
Audit and assurance
NIST names auditors, risk managers, executives and boards among the CSF's intended users (NIST CSWP 29, 2024). Internal audit teams often use the six functions as a structure for cyber audit plans, and the profiles make it easier to report progress in language a board understands.
Mapping to DORA, NIS2, ISO 27001 and PCI DSS
The CSF is voluntary. It does not replace any law or certification, but it can act as a common language across them. At a high level:
- DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 to a wide range of EU financial entities. Its pillars of information and communications technology (ICT) risk management, incident reporting, resilience testing and third-party risk line up broadly with Govern, Identify, Protect, Detect, Respond and Recover (Central Bank of Ireland).
- NIS2 (Directive (EU) 2022/2555) had to be transposed into national law by 17 October 2024. In May 2025 the European Commission sent reasoned opinions to 19 member states, including Ireland, for not fully transposing it (European Commission, 2025). Its risk management and governance duties map well to Govern and Protect. See our NIS2 guide for finance teams.
- ISO/IEC 27001:2022 is a certifiable management system standard, published on 25 October 2022, with certificates to the previous edition withdrawn after 31 October 2025 (National Standards Authority of Ireland, NSAI). The CSF is not certifiable, so many organisations certify to ISO 27001 and use the CSF to explain posture to leadership.
- PCI DSS (the Payment Card Industry Data Security Standard): in July 2026 the PCI Security Standards Council published a mapping of PCI DSS v4.0.1 to CSF 2.0, while stressing that the two are not interchangeable (PCI Security Standards Council, 2026).
Mappings are guides, not proof of compliance. Each regime has its own specific requirements, and this article is general information rather than legal advice.
Frequently asked questions
Is the NIST CSF mandatory in Ireland or the UK?
No. It is a voluntary US framework, but it is widely used internationally as a reference model alongside binding rules such as DORA and NIS2.
What is new in NIST CSF 2.0 compared with 1.1?
The main change is the Govern function, alongside a broader audience beyond critical infrastructure, more attention to supply chain risk, and new resources such as Quick-Start Guides and implementation examples.
Can a small finance team use the CSF?
Yes. NIST publishes a small business Quick-Start Guide. Start with a simple current profile across the six functions and pick two or three gaps to close.
The CSF gives finance professionals a shared vocabulary for cyber risk that fits the governance skills they already have. To build that knowledge further, explore Learnsignal's compliance and risk CPD courses.
This page was last updated:
Learnsignal Education Team
Expert Tutor at Learnsignal
Qualified professional with years of experience helping students advance their professional careers.
View all posts by Learnsignal Education Team
